Re: [malware-list] [RFC 0/5] [TALPA] Intro to a linuxinterfaceforon access scanning

Mihai Donțu
2008-08-07T00:56:50Z

On Wednesday 06 August 2008, Adrian Bunk wrote:
> On Wed, Aug 06, 2008 at 12:07:57PM +0100, tvrtko.ursulin@sophos.com wrote:
> > Adrian Bunk <bunk@kernel.org> wrote on 06/08/2008 11:50:08:
> > > As an observer of this thread:
> > >
> > > - Some set of requirements suddenly appears out of the void on
> > > linux-kernel.
> >
> > Because previously it was said to go away and come back with a clear list
> > of requirements. And here you make it sound like a negative thing. See
> > what I am talking about?
>
> Both of my points belong together.
>
> > > - Noone is able and/or willing to exactly describe the problem(s) they
> > > are trying to solve.
> >
> > Hopefully we will get there. Very little time has passed since the
> > discussion has started, even less considering the time zone difference
> > for some.
> >
> > > With this status quo the discussion is going nowhere - Linux kernel
> > > development does not work this way.
> > >
> > > The aim is not to include this code, but to find the best technical
> > > solution for your problem(s) - no matter whether this will have
> > > anything in common with the list of requirements and the code posted or
> > > not.
> >
> > I completely agree with that. Here I was just pointing out that what Greg
> > wrote was untrue and exaggerated so not helping the discussion at all.
>
> Until now the main discussion participant from the AV side is
> Jonathan Press.

Well, if you insist, but I must state that this mail represents my own opinion
and not my employer's (that's because all the people I could consult with are
sleeping :) ).

> But the real discussion hasn't even started since the information
> required is not available.
>
> And as soon as the information for the real discussion is available all
> these initial discussions become irrelevant.

> - Noone is able and/or willing to exactly describe the problem(s) they
> are trying to solve.

Well, here is one attempt.

A good percentage of an AV product's job is to prevent exploitation of a
security hole in a product before the vendor (assuming the vendor admits it's
bug and not a misuse of the product's features).

Most distribution makers go through a lot of work before releasing an update,
which might take days. Add to this the fact that some users refuse to update
periodically (because one operating system out there shattered the belief in
this practice) and that some of them are willing to pay to not care. This is
reason enough for most AV vendors.

In the present, on the Linux Desktop, this is [still] hypothetical talk and
God help it will remain so. However, if there is one incredibly small chance
that one (new?) type of malware can spread to a large number of users, then
AV vendors will race for creating a solution because there will _definitely_
be people needing help with this (please notice that the IQ scale starts from
zero and not from 130 :) ).

I think this patch is trying to do what dazuko hasn't managed to do (yet): get
into mainline. :)

--
Mihai Donțu